V5 MSR2600-10-WINET + V7 MSR830-6EI-WINET VPN组网配置

V5 MSR2600-10-WINET 固定电信IP

 V7 MSR830-6EI-WINET 电信拔号宽带非固定IP

要求：V7 MSR830拔号后通过公网能够与MSR2600的内网连通

以下是配置信息，供参考。

//MSR830 V7平台客户端向MSR2600 V5平台主动发起IKE协商建立IPSEC连接
sysname nssy
 domain default enable system
 dns proxy enable
 telnet server enable
 port-security enable
acl number 3001
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.1.0 0.0.0.255
acl number 3002
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.2.0 0.0.0.255
acl number 3003
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.3.0 0.0.0.255
acl number 3004
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.4.0 0.0.0.255
acl number 3005
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.5.0 0.0.0.255
acl number 3006
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.6.0 0.0.0.255
acl number 3007
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.7.0 0.0.0.255
acl number 3008
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.8.0 0.0.0.255
acl number 3009
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.9.0 0.0.0.255
acl number 3010
 rule 0 permit ip source 172.20.0.0 0.0.0.255 destination 172.20.10.0 0.0.0.255
acl number 3100
 rule 1 deny ip source 172.20.0.0 0.0.0.255 destination 172.20.1.0 0.0.0.255
 rule 100 permit ip

dhcp enable
undo dhcp server ip-pool vlan1
dhcp server ip-pool vlan1 extended
 network ip range 172.20.0.150 172.20.0.199
 network mask 255.255.255.0
 gateway-list 172.20.0.1
 dns-list 202.96.134.33 202.96.134.133

interface Vlan-interface1
 ip address 172.20.0.1 255.255.255.0
 tcp mss 1024
 dhcp server apply ip-pool vlan1

interface GigabitEthernet0/0
 port link-mode route
 nat outbound 3100
 ip address 10.1.121.251 255.255.255.0
 tcp mss 1024
 ipsec no-nat-process enable
 ipsec policy nssy

ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/0 10.1.121.250

ike local-name nssy

ike proposal 101
 authentication-algorithm md5

ike peer juneng_beizhan
 exchange-mode aggressive
 proposal 101
 pre-shared-key simple sknssy
 id-type name
 remote-name juneng_beizhan
 local-name nssy
 nat traversal
quit

ipsec transform-set juneng_beizhan
 encapsulation-mode tunnel
 transform esp
 esp authentication-algorithm md5
 esp encryption-algorithm des

ipsec policy nssy 1 isakmp
 security acl 3001
 ike-peer juneng_beizhan
 transform-set juneng_beizhan
quit

interface GigabitEthernet0/0
 ipsec no-nat-process enable
 ipsec policy nssy
quit

 
<JuNeng_BeiZhan>

sysname JuNeng_BeiZhan
telnet server enable
ip load-sharing mode per-flow src-ip global
dhcp enable
dhcp server always-broadcast
dns proxy enable
password-recovery enable

undo dhcp server ip-pool lan1
dhcp server ip-pool vlan1
 gateway-list 172.20.1.1
 network 172.20.1.0 mask 255.255.255.0
 dns-list 202.96.134.33 202.96.134.133
 forbidden-ip 172.20.1.2 forbidden-ip 172.20.1.149
quit

interface Vlan-interface1
 ip address 172.20.1.1 255.255.255.0
 tcp mss 1280
 dhcp server apply ip-pool vlan1

acl advanced 3001
 rule 0 permit ip source 172.20.1.0 0.0.0.255 destination 172.20.0.0 0.0.0.255
 rule 1 deny ip

acl advanced 3100
 rule 1 deny ip source 172.20.1.0 0.0.0.255 destination 172.20.0.0 0.0.0.255
 rule 100 permit ip

interface GigabitEthernet0/0
 port link-mode route
 description Single_Line1
 ip address 10.1.121.250 255.255.255.0
 nat outbound 3100
 ipsec apply policy juneng_beizhan
quit

ip route-static 0.0.0.0 0 GigabitEthernet0/0 10.1.121.251

ike identity fqdn juneng_beizhan

ike keychain juneng_beizhan
 pre-shared-key address 10.1.121.251 255.255.255.255 key simple sknssy
quit

ike proposal 101
 authentication-algorithm md5

ike profile juneng_beizhan
 keychain juneng_beizhan
 exchange-mode aggressive
 local-identity fqdn juneng_beizhan
 match remote identity fqdn nssy
 proposal 101
quit

ipsec transform-set juneng_beizhan
 esp encryption-algorithm des-cbc
 esp authentication-algorithm md5
quit

ipsec policy juneng_beizhan 1 isakmp
 transform-set juneng_beizhan
 security acl 3001
 remote-address 10.1.121.251
 ike-profile juneng_beizhan
quit

interface GigabitEthernet0/0
  ipsec apply policy juneng_beizhan
quit